AI Threat Alert
CVE-2026-10547: Langflow: broken access control enables cache poisoning
HIGHIBM Langflow's deprecated vertices-build endpoint fails to verify that the calling user actually owns the flow being executed, letting any authenticated user inject arbitrary graph data into a cache shared across all users. For a CISO, the real exposure is blast radius within a single Langflow instance: any low-privilege account (PR:L, no user interaction needed) can pollute or hijack another tenant's workflow execution or knock it offline, which matters if Langflow is used as a shared, multi-tenant agent-building platform rather than single-user tooling. The 8.1 CVSS reflects severe integrity and availability impact, but exploitation likelihood is currently modest — EPSS sits at 0.225% (87th percentile, not top-tier), there's no public PoC or Nuclei template, it's not in CISA KEV, and CISA's own SSVC decision is TRACK (monitor, not urgent remediation). Action: upgrade past Langflow 1.10.3 to the patched release, and in the interim restrict multi-tenant Langflow deployments to trusted users only or disable/proxy the deprecated `/api/v1/build/{flow_id}/vertices` endpoint; monitor for unexpected vertex/graph mutations on flows a given API key/session shouldn't own.
What is the risk?
Moderate risk overall. Technically easy to trigger (AC:L, no user interaction) and requires only a low-privileged authenticated account, which combined with high integrity and availability impact drives the 8.1 CVSS score. However, real-world exploitation pressure is currently low: EPSS is well under 1%, no public exploit or scanner signature exists, it's absent from CISA KEV, and CISA's SSVC decision is TRACK rather than Attend/Act. Risk rises sharply for organizations running Langflow as a shared, multi-tenant instance (e.g., internal AI agent-building platform accessible to many teams or external partners) since the confused-ownership flaw is only meaningful where multiple untrusted principals share one deployment.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
1) Upgrade Langflow beyond 1.10.3 to the vendor-patched version referenced in the IBM advisory. 2) Until patched, restrict access to Langflow instances to a single trusted tenant or enforce strict per-user isolation at the network/reverse-proxy layer (no shared multi-tenant deployments). 3) Disable or block the deprecated
/api/v1/build/{flow_id}/verticesendpoint via API gateway rules if not required by current workflows. 4) Audit authentication and authorization logs for anomalous cross-flow build requests (a user's session invoking build operations against flow_ids they don't own). 5) Monitor for unexpected graph/vertex changes or execution failures in flows as an indicator of cache pollution, and review Langflow audit logs post-patch for any historical exploitation.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-10547?
IBM Langflow's deprecated vertices-build endpoint fails to verify that the calling user actually owns the flow being executed, letting any authenticated user inject arbitrary graph data into a cache shared across all users. For a CISO, the real exposure is blast radius within a single Langflow instance: any low-privilege account (PR:L, no user interaction needed) can pollute or hijack another tenant's workflow execution or knock it offline, which matters if Langflow is used as a shared, multi-tenant agent-building platform rather than single-user tooling. The 8.1 CVSS reflects severe integrity and availability impact, but exploitation likelihood is currently modest — EPSS sits at 0.225% (87th percentile, not top-tier), there's no public PoC or Nuclei template, it's not in CISA KEV, and CISA's own SSVC decision is TRACK (monitor, not urgent remediation). Action: upgrade past Langflow 1.10.3 to the patched release, and in the interim restrict multi-tenant Langflow deployments to trusted users only or disable/proxy the deprecated `/api/v1/build/{flow_id}/vertices` endpoint; monitor for unexpected vertex/graph mutations on flows a given API key/session shouldn't own.
Is CVE-2026-10547 actively exploited?
No confirmed active exploitation of CVE-2026-10547 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-10547?
1) Upgrade Langflow beyond 1.10.3 to the vendor-patched version referenced in the IBM advisory. 2) Until patched, restrict access to Langflow instances to a single trusted tenant or enforce strict per-user isolation at the network/reverse-proxy layer (no shared multi-tenant deployments). 3) Disable or block the deprecated `/api/v1/build/{flow_id}/vertices` endpoint via API gateway rules if not required by current workflows. 4) Audit authentication and authorization logs for anomalous cross-flow build requests (a user's session invoking build operations against flow_ids they don't own). 5) Monitor for unexpected graph/vertex changes or execution failures in flows as an indicator of cache pollution, and review Langflow audit logs post-patch for any historical exploitation.
What systems are affected by CVE-2026-10547?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration platforms, multi-tenant AI development platforms.
What is the CVSS score for CVE-2026-10547?
CVE-2026-10547 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.22%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012 Valid Accounts AML.T0029 Denial of AI Service AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.
Exploitation Scenario
An attacker with a valid but low-privileged Langflow account (e.g., a contractor or another business unit with access to the shared instance) enumerates or guesses a flow_id belonging to a higher-value target flow (say, an internal RAG pipeline used for customer support automation). They send a crafted POST to the deprecated `/api/v1/build/{flow_id}/vertices` endpoint with malicious graph/vertex data. Because ownership isn't validated, the shared build cache accepts the injected data for that flow_id. The next time a legitimate user or scheduled job triggers that flow, it executes the attacker's injected graph configuration instead of the intended one — potentially rerouting outputs, corrupting execution state, or repeatedly triggering cache invalidation to degrade availability (DoS) for all users of that flow.
Weaknesses (CWE)
CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H References
Timeline
Related Vulnerabilities
CVE-2026-10561 10.0 Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflow CVE-2026-10134 10.0 Langflow: unauthenticated RCE via tool_code injection
Same package: langflow CVE-2026-33309 9.9 langflow: Path Traversal enables file access
Same package: langflow CVE-2026-55255 9.9 Langflow: IDOR allows cross-user flow execution
Same package: langflow CVE-2026-7873 9.9 Langflow: authenticated RCE enables credential theft
Same package: langflow